Signal
Signal is a peer-to-peer messaging app which can be installed on Android or iOS. It is the gold standard for secure messaging trusted by high level government officials for the following reasons:
- All messages are end-to-end encrypted by default.
- No metadata is stored permanently when you message another signal user.
- All code for the app is open source and publicly auditable.
Peer-to-Peer (P2P)
This refers to a system where messages between two devices are sent without a centralised server. A good example would be a standard walkie-talkie. It means that device A talks to device B without a device inbetween them that centralises the conversation.
Standard Encryption (TLS)
Standard encryption is what protects most of the internet. When you log into your banking app, check your emails, or visit a secure website, you are interacting with standard encryption.
End-to-End Encryption (E2EE)
E2EE means that data is encrypted at the point of the sender and can only decrypted by the receiver. It differs from standard encryption in that the server on which the data is stored cannot read any contents. WhatsApp, Signal and iMessage chats are all end-to-end encrypted, meaning Meta, Signal and Apple cannot read the contents of your conversations (in theory).
Metadata
Metadata means "data about data". If you were making a landline call with someone, the data would be the electronic signals representing your voice being transmitted to the other person. The metadata would be the phone number of who you called, how long the call lasted for, and where you called them from.
Metadata often describes things far more valuable than raw data itself. They describe who is in contact with whom, for how long, where they frequent and what their daily behaviour is. Emails, WhatsApp, Telegram and Messenger communications all generate significant metadata, which can be used to map networks of user activity.
If you want to improve your digital privacy and reduce your exposure to hackers, you should try to minimise the metadata that you create.
Against most threat actors, email is a generally secure and encrypted means of communication. However, there are several elements behind email that make it undesirable if your primary goal is creating a private and secure channel for sending information.
The most important thing to note is that email messages don't travel directly from you to the recipient. They pass through several computer servers owned by different companies on their journey. At each stop, if the connection isn't protected, the message could be copied or read by:
- Your internet provider
- Someone on the same WiFi network (like a café or airport)
- Employees at smaller email companies handling the message
- Hackers who've gained access to part of the network
Communications between major providers (like Gmail to Outlook, or iCloud to Yahoo) generally don't have this issue, but it remains a risk for smaller providers or unusual routing paths.
Additional problems with email include that significant amounts of metadata is produced when sending emails, email content is often stored in plaintext on the email server, and emails can be forwarded or sent to the wrong person especially when using the "reply all" feature.
Open Source
"Open Source" refers to software or some application where the source code of the software is open to be read by anyone. Open source applications are typically considered to be more secure than their closed source alternatives because any software vulnerabilities in the code can be seen by anyone reviewing the code. However, open source applications are not completely risk free from vulnerabilities as is all software.
Open source software is freely modifiable and often preserves user privacy much more than closed source alternatives.
Pretty Good Privacy (PGP)
PGP is a means of encrypting or signing data which is commonly used for encrypting messages between a sender and a recipient. Because email has several flaws that make it insecure for communicating sensitive information, using a PGP public key to encrypt a message is a good way to make sure that only the recipient can read it.
A PGP public key and private key is generated by a message recipient. The public key (which is a long string of text) is provided to a message sender. The sender then encrypts their message using this long string of text. After they have sent their message to the recipient, only the recipient can read the content of the message by decrypting it with their private key.